CVE-2019-5448: Yarn before 1.17.3 Missing Encryption of Sensitive Data
Summary
CVE-2019-5448: Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network. Affects node-yarnpkg across 2 version ranges.
< 1.13.0-3
< 2c915bda5f35bb805820c159257d96df23e3e9d8
Fixed in 1.13.0-3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Yarn is a package manager for JavaScript that allows developers to manage dependencies efficiently. It is widely used in the JavaScript ecosystem for building applications. However, versions of Yarn before 1.17.3 are vulnerable to Missing Encryption of Sensitive Data. This vulnerability occurs due to the presence of HTTP URLs in the lockfile, which causes unencrypted authentication data to be sent over the network. This can lead to unauthorized access to sensitive information and potential security breaches.
Vulnerability Detail
The vulnerability in Yarn before 1.17.3 arises from the lack of encryption for sensitive data transmitted over the network. When HTTP URLs are present in the lockfile, authentication data is sent without encryption, making it susceptible to interception and unauthorized access. Attackers can exploit this vulnerability to obtain sensitive information, such as authentication tokens or credentials, and potentially compromise the security of the application or system. The severity of this vulnerability is rated as HIGH with a CVSS score of 8.1.
How To Fix
Minimum fixed version
1.13.0-3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade node-yarnpkgTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. However, it is crucial to update Yarn to the fixed version as soon as possible to mitigate the risk of sensitive data exposure.
Conclusion
Yarn before version 1.17.3 is vulnerable to Missing Encryption of Sensitive Data, which can result in the exposure of sensitive information during transmission. It is crucial to update Yarn to the fixed version to ensure the encryption of sensitive data and mitigate the risk of unauthorized access. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for node-yarnpkg →
FAQ
Yarn is a package manager for JavaScript that helps manage dependencies in JavaScript projects. It provides a faster and more reliable alternative to npm.
The vulnerability allows unencrypted transmission of sensitive data, such as authentication tokens or credentials, over the network. This can lead to unauthorized access to sensitive information and potential security breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities without requiring access to the code or installation.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
You can find more information about this vulnerability in the National Vulnerability Database (NVD) at https://nvd.nist.gov/vuln/detail/CVE-2019-5448.
Related vulnerabilities
Recent vulnerabilities recorded for node-yarnpkg.
